CVE-2026-59954

{
  "id": "CVE-2026-59954",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T17:16:50.960",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a non-canonical appId variant during authentication while downstream request handling resolves it to the protected app, including accent variants under accent-insensitive collations or trailing-space variants under PAD SPACE collations on /configs and /configfiles endpoints. This issue is fixed in version 2.5.2."
    },
    {
      "lang": "es",
      "value": "Apollo es un sistema de gestión de configuración fiable adecuado para escenarios de gestión de configuración de microservicios. Antes de la 2.5.2, Apollo ConfigService podría permitir el acceso no autorizado a los datos de configuración cuando la autenticación por AccessKey o clave de gestión está habilitada porque ConfigService puede aceptar una variante de appId no canónica durante la autenticación mientras que el manejo de solicitudes posteriores lo resuelve a la aplicación protegida, incluyendo variantes con acento bajo cotejos insensibles a los acentos o variantes con espacios finales bajo cotejos PAD SPACE en los puntos finales /configs y /configfiles. Este problema está solucionado en la versión 2.5.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "apolloconfig",
          "product": "apollo",
          "versions": [
            {
              "version": "< 2.5.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T17:26:16.323859Z",
          "id": "CVE-2026-59954",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apolloconfig/apollo/commit/310809d557e01c6803051736cd525e333ffe00ec",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/apolloconfig/apollo/releases/tag/v2.5.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/apolloconfig/apollo/security/advisories/GHSA-4w3q-qpfq-v992",
      "source": "[email protected]"
    }
  ]
}